主體金鑰識別碼（Subject Key Identifier）

Subject Key Identifier

If present, the subjectKeyIdentifier MUST be set as defined within RFC 5280, Section 4.2.1.2. The CA MUST generate a subjectKeyIdentifier that is unique within the scope of all Certificates it has issued for each unique public key (the subjectPublicKeyInfo field of the tbsCertificate). For example, CAs may generate the subject key identifier using an algorithm derived from the public key, or may generate a sufficiently-large unique number, such as by using a CSPRNG.

若存在，subjectKeyIdentifier 應（MUST）依 RFC 5280 第 4.2.1.2 節 所定義之方式設定。CA 應（MUST）針對每個唯一公開金鑰（即 tbsCertificate 的 subjectPublicKeyInfo 欄位），產生一個於其所有已簽發憑證中均唯一之 subjectKeyIdentifier。例如，CA 可使用以公開金鑰為輸入之演算法產生 subjectKeyIdentifier，或可使用 CSPRNG（密碼學安全偽亂數產生器）產生一個足夠大之唯一數值。